APPN filtering support

Before we discuss APPN filtering support, an explanation of node types in an APPN network is needed:

• A peripheral node is at the edge of a network. It can participate in the network, but it cannot provide intermediate routing to other systems in the network. A peripheral node can be an end node (EN) such as MADISON and PARIS in the figure below. A peripheral node can be a low-entry networking node (LEN), such as CHICPC1 and CHICPC2. A peripheral node can also be a network node in a different network (NETID). From CHICAGO's perspective, LONDON is a peripheral node.
• A network node (NN) provides routing services among systems in the network. In CHICAGO, and ATLANTA are examples of network nodes.
• A Branch Extender node is an extension to the APPN network architecture that appears as a network node (NN) to the Local Area Network (LAN), and as an end node (EN) to the Wide Area Network (WAN). This reduces topology flows about resources in the LAN from being disconnected from the WAN.

APPN filtering support provides the ability to create a firewall that is based on APPC location names. You use two different types of filter lists:

• A session-endpoint filter controls access to and from a location. For example, in the session endpoint filter on the CHICAGO system in the figure below, it specifies which locations can establish a session with CHICAGO or with PAYROLL. CHICAGO and PAYROLL are two different locations on the CHICAGO system.

  Similarly, the session endpoint filter on the MADISON system specifies which locations can establish a session with the MADISON location.

  Figure 11. Two connected APPN networks

  On iSeries, you can use the new QAPPNSSN configuration list, by itself or in conjunction with the QAPPNRMT configuration list, to create a session endpoint filter.

• A directory search filter on a network node determines the following for its associated peripheral nodes:
  • Access from the peripheral node (when the peripheral node is the requester). For example, in you can use the directory search filter on LONDON to control the possible destinations for users on the PARIS system. Similarly, you can use the directory search filter on CHICAGO to control the possible destinations for users on CHICPC1 and CHICPC2.
  • Access to the peripheral node (when the peripheral node is the destination). In for example, you can use the directory search filter on CHICAGO to determine which locations can access CHICPC1. Because both CHICAGO and DALLAS provide connections to MADISON, you must set up the directory search filters on both CHICAGO and DALLAS to restrict connections to MADISON.

    Similarly, you can use the directory search filter on CHICAGO to specify which USANET locations are permissible destinations for EURONET users.

  To create a directory search filter use the QAPPNDIR configuration list.